Hi, We would like to make it possible for everyone in the company to use Thunderbird. Before rolling it out in larger scale, we would like to ensure that the data privacy is compliant, and hope that you can support with answering some related questions, see below. Many thanks in advance. 1. Where is your contracting entity established (registered office)? A) EU/EEA B) Andorra, Argentina, Bailiwick of Guernsey, Faroe Islands, Isle of Man, Israel, Japan, Jersey, New Zeeland, Switzerland, United Kingdom, Uruguay and South Korea. C) Other, please insert country. 2. Do you use sub-processors in order to perform this service? A) Yes. B) No. 3. If sub-processors are used please enter full name of each relevant entity and where data is located when processed by each specific sub-processor. 4. If personal data is transferred outside EU/EEA, please explain what supplementary measures you have adopted to comply with the Schrems II-ruling (C-311-18) by the European Court. Please also see Guideline from EDPB (adopted 2021-06-18). A) [Insert information] B) No transfers outside EU/EEA. C) Do not know. 5. Please provide an overview of relevant existing certificates. A) [Insert information] B) We do not hold any relevant certificates. 6. Please provide an overview of existing third party audits reports (e.g. SOC II, ISAE3402 etc.) A) [Insert information] B) We have not conducted any relevant audits. 7. Do you have documentation to support what relevant technical and operational measures you have implemented? A) Yes. B) No. C) We have implemented both technical and operational measures but the documentation is not complete. 8. Have you implemented processes/channels for internal reporting of suspected personal data breaches and security incidents? A) Yes, we notify our customers within 72 hours or less. B) Yes, we notify customers. C) No. 9. Have you notified supervisory authority of any personal data breaches the last three years? A) Yes, investigation by supervisory authority is ongoing. B) Yes, but our notification was dismissed without any further action. C) No. 10. Have you appointed an DPO (Data protection Officer)? A) Yes, we are required to. B) Yes, but we are not required to. C) No, we are not required to. D) No. Best regards